@upload-post/mcp 0.3.0

package/dist/oauth/http_utils.js

@@ -0,0 +1,48 @@
+const MAX_BODY_BYTES = 64 * 1024;
+export async function readBuffer(req) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        const buf = chunk;
+        total += buf.length;
+        if (total > MAX_BODY_BYTES)
+            throw new Error("body too large");
+        chunks.push(buf);
+    }
+    return Buffer.concat(chunks);
+}
+export async function readJsonBody(req) {
+    const buf = await readBuffer(req);
+    if (buf.length === 0)
+        return null;
+    return JSON.parse(buf.toString("utf8"));
+}
+export async function readFormBody(req) {
+    const buf = await readBuffer(req);
+    if (buf.length === 0)
+        return {};
+    const params = new URLSearchParams(buf.toString("utf8"));
+    const out = {};
+    for (const [k, v] of params)
+        out[k] = v;
+    return out;
+}
+export function sendJson(res, status, body) {
+    res.statusCode = status;
+    res.setHeader("content-type", "application/json");
+    res.setHeader("cache-control", "no-store");
+    res.end(JSON.stringify(body));
+}
+export function sendError(res, status, error, description) {
+    const body = { error };
+    if (description)
+        body.error_description = description;
+    sendJson(res, status, body);
+}
+export function sendRedirect(res, url) {
+    res.statusCode = 302;
+    res.setHeader("location", url);
+    res.setHeader("cache-control", "no-store");
+    res.end();
+}
+//# sourceMappingURL=http_utils.js.map

package/dist/oauth/http_utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http_utils.js","sourceRoot":"","sources":["../../src/oauth/http_utils.ts"],"names":[],"mappings":"AAEA,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAe,CAAC;QAC5B,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;QACpB,IAAI,KAAK,GAAG,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IACrD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IACrD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IACzE,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,GAAmB,EACnB,MAAc,EACd,KAAa,EACb,WAAoB;IAEpB,MAAM,IAAI,GAA2B,EAAE,KAAK,EAAE,CAAC;IAC/C,IAAI,WAAW;QAAE,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAmB,EAAE,GAAW;IAC3D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;IACrB,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC/B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC"}

package/dist/oauth/introspect_cache.d.ts

@@ -0,0 +1,19 @@
+import type { IntrospectResult } from "./upstream_client.js";
+/**
+ * Tiny in-process TTL cache for introspection results. Avoids round-tripping
+ * upstream on every /mcp request. Keyed by SHA-256(token) so plaintext tokens
+ * are never held in memory beyond the request that issued the lookup.
+ *
+ * No LRU bound by count: entries expire on TTL and are evicted lazily on read.
+ * If you anticipate >10k concurrent active tokens, swap this for `lru-cache`.
+ */
+export declare class IntrospectCache {
+    private readonly ttlMs;
+    private store;
+    constructor(ttlMs: number);
+    get(token: string): IntrospectResult | null;
+    set(token: string, value: IntrospectResult): void;
+    invalidate(token: string): void;
+    private keyFor;
+}
+//# sourceMappingURL=introspect_cache.d.ts.map

package/dist/oauth/introspect_cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect_cache.d.ts","sourceRoot":"","sources":["../../src/oauth/introspect_cache.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D;;;;;;;GAOG;AACH,qBAAa,eAAe;IAGd,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,OAAO,CAAC,KAAK,CAAqE;gBAErD,KAAK,EAAE,MAAM;IAE1C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAW3C,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI;IAOjD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI/B,OAAO,CAAC,MAAM;CAGf"}

package/dist/oauth/introspect_cache.js

@@ -0,0 +1,40 @@
+import { createHash } from "node:crypto";
+/**
+ * Tiny in-process TTL cache for introspection results. Avoids round-tripping
+ * upstream on every /mcp request. Keyed by SHA-256(token) so plaintext tokens
+ * are never held in memory beyond the request that issued the lookup.
+ *
+ * No LRU bound by count: entries expire on TTL and are evicted lazily on read.
+ * If you anticipate >10k concurrent active tokens, swap this for `lru-cache`.
+ */
+export class IntrospectCache {
+    ttlMs;
+    store = new Map();
+    constructor(ttlMs) {
+        this.ttlMs = ttlMs;
+    }
+    get(token) {
+        const key = this.keyFor(token);
+        const entry = this.store.get(key);
+        if (!entry)
+            return null;
+        if (entry.expiresAt < Date.now()) {
+            this.store.delete(key);
+            return null;
+        }
+        return entry.value;
+    }
+    set(token, value) {
+        this.store.set(this.keyFor(token), {
+            value,
+            expiresAt: Date.now() + this.ttlMs,
+        });
+    }
+    invalidate(token) {
+        this.store.delete(this.keyFor(token));
+    }
+    keyFor(token) {
+        return createHash("sha256").update(token).digest("hex");
+    }
+}
+//# sourceMappingURL=introspect_cache.js.map

package/dist/oauth/introspect_cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect_cache.js","sourceRoot":"","sources":["../../src/oauth/introspect_cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;GAOG;AACH,MAAM,OAAO,eAAe;IAGG;IAFrB,KAAK,GAAG,IAAI,GAAG,EAA0D,CAAC;IAElF,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAE9C,GAAG,CAAC,KAAa;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,KAAa,EAAE,KAAuB;QACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACjC,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK;SACnC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/oauth/metadata.d.ts

@@ -0,0 +1,35 @@
+import type { ServerResponse } from "node:http";
+import type { OAuthConfig } from "./config.js";
+/**
+ * RFC 9728 — OAuth 2.0 Protected Resource Metadata.
+ * claude.ai (and other MCP-spec clients) fetch this when they hit /mcp and
+ * receive a 401 with WWW-Authenticate pointing here. From it they learn which
+ * authorization servers can issue tokens for this resource.
+ */
+export declare function protectedResourceMetadata(cfg: OAuthConfig): {
+    resource: string;
+    authorization_servers: string[];
+    bearer_methods_supported: string[];
+    resource_documentation: string;
+    scopes_supported: string[];
+};
+/**
+ * RFC 8414 — OAuth 2.0 Authorization Server Metadata.
+ * Claude.ai uses this to discover where to register, where to send the user
+ * for authorization, and where to exchange codes for tokens.
+ */
+export declare function authorizationServerMetadata(cfg: OAuthConfig): {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    revocation_endpoint: string;
+    registration_endpoint: string;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    code_challenge_methods_supported: string[];
+    scopes_supported: string[];
+    service_documentation: string;
+};
+export declare function serveJson(res: ServerResponse, body: unknown, status?: number): void;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/oauth/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,WAAW;;;;;;EAQzD;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,WAAW;;;;;;;;;;;;EAc3D;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,IAAI,CAMhF"}

package/dist/oauth/metadata.js

@@ -0,0 +1,43 @@
+/**
+ * RFC 9728 — OAuth 2.0 Protected Resource Metadata.
+ * claude.ai (and other MCP-spec clients) fetch this when they hit /mcp and
+ * receive a 401 with WWW-Authenticate pointing here. From it they learn which
+ * authorization servers can issue tokens for this resource.
+ */
+export function protectedResourceMetadata(cfg) {
+    return {
+        resource: `${cfg.issuer}/mcp`,
+        authorization_servers: [cfg.issuer],
+        bearer_methods_supported: ["header"],
+        resource_documentation: "https://docs.upload-post.com/guides/mcp-server-integration",
+        scopes_supported: ["mcp.full"],
+    };
+}
+/**
+ * RFC 8414 — OAuth 2.0 Authorization Server Metadata.
+ * Claude.ai uses this to discover where to register, where to send the user
+ * for authorization, and where to exchange codes for tokens.
+ */
+export function authorizationServerMetadata(cfg) {
+    return {
+        issuer: cfg.issuer,
+        authorization_endpoint: `${cfg.issuer}/authorize`,
+        token_endpoint: `${cfg.issuer}/token`,
+        revocation_endpoint: `${cfg.issuer}/revoke`,
+        registration_endpoint: `${cfg.issuer}/register`,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        token_endpoint_auth_methods_supported: ["none"],
+        code_challenge_methods_supported: ["S256"],
+        scopes_supported: ["mcp.full"],
+        service_documentation: "https://docs.upload-post.com/guides/mcp-server-integration",
+    };
+}
+export function serveJson(res, body, status = 200) {
+    res.statusCode = status;
+    res.setHeader("content-type", "application/json");
+    res.setHeader("cache-control", "public, max-age=3600");
+    res.setHeader("access-control-allow-origin", "*");
+    res.end(JSON.stringify(body));
+}
+//# sourceMappingURL=metadata.js.map

package/dist/oauth/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAgB;IACxD,OAAO;QACL,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,MAAM;QAC7B,qBAAqB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;QACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,sBAAsB,EAAE,4DAA4D;QACpF,gBAAgB,EAAE,CAAC,UAAU,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAgB;IAC1D,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,sBAAsB,EAAE,GAAG,GAAG,CAAC,MAAM,YAAY;QACjD,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,QAAQ;QACrC,mBAAmB,EAAE,GAAG,GAAG,CAAC,MAAM,SAAS;QAC3C,qBAAqB,EAAE,GAAG,GAAG,CAAC,MAAM,WAAW;QAC/C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,gBAAgB,EAAE,CAAC,UAAU,CAAC;QAC9B,qBAAqB,EAAE,4DAA4D;KACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAmB,EAAE,IAAa,EAAE,MAAM,GAAG,GAAG;IACxE,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IACvD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC"}

package/dist/oauth/registration.d.ts

@@ -0,0 +1,14 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+/**
+ * RFC 7591 — Dynamic Client Registration.
+ *
+ * Stateless: we don't persist registered clients. PKCE + the redirect_uri
+ * allow-list (enforced server-side on token exchange) cover the security
+ * properties that registration would otherwise provide. So /register just
+ * mints a fresh client_id and echoes back the metadata.
+ *
+ * This is the pragmatic pattern used by most public-client MCP servers — the
+ * spec explicitly allows it (§3.2.1 "client_secret is OPTIONAL").
+ */
+export declare function handleRegistration(req: IncomingMessage, res: ServerResponse): Promise<void>;
+//# sourceMappingURL=registration.d.ts.map

package/dist/oauth/registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../src/oauth/registration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAKjE;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BjG"}

package/dist/oauth/registration.js

@@ -0,0 +1,40 @@
+import { randomBytes } from "node:crypto";
+import { readJsonBody, sendJson, sendError } from "./http_utils.js";
+/**
+ * RFC 7591 — Dynamic Client Registration.
+ *
+ * Stateless: we don't persist registered clients. PKCE + the redirect_uri
+ * allow-list (enforced server-side on token exchange) cover the security
+ * properties that registration would otherwise provide. So /register just
+ * mints a fresh client_id and echoes back the metadata.
+ *
+ * This is the pragmatic pattern used by most public-client MCP servers — the
+ * spec explicitly allows it (§3.2.1 "client_secret is OPTIONAL").
+ */
+export async function handleRegistration(req, res) {
+    let body = {};
+    try {
+        body = (await readJsonBody(req)) ?? {};
+    }
+    catch {
+        return sendError(res, 400, "invalid_request", "Body must be valid JSON");
+    }
+    const clientName = typeof body.client_name === "string" ? body.client_name : "MCP Client";
+    const redirectUris = Array.isArray(body.redirect_uris) ? body.redirect_uris : [];
+    if (redirectUris.length === 0) {
+        return sendError(res, 400, "invalid_redirect_uri", "At least one redirect_uri is required");
+    }
+    const clientId = `mcp_${randomBytes(16).toString("hex")}`;
+    const issuedAt = Math.floor(Date.now() / 1000);
+    sendJson(res, 201, {
+        client_id: clientId,
+        client_id_issued_at: issuedAt,
+        client_name: clientName,
+        redirect_uris: redirectUris,
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        scope: "mcp.full",
+    });
+}
+//# sourceMappingURL=registration.js.map

package/dist/oauth/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","sourceRoot":"","sources":["../../src/oauth/registration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAoB,EAAE,GAAmB;IAChF,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1F,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,EAAE,uCAAuC,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE/C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACjB,SAAS,EAAE,QAAQ;QACnB,mBAAmB,EAAE,QAAQ;QAC7B,WAAW,EAAE,UAAU;QACvB,aAAa,EAAE,YAAY;QAC3B,0BAA0B,EAAE,MAAM;QAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,KAAK,EAAE,UAAU;KAClB,CAAC,CAAC;AACL,CAAC"}

package/dist/oauth/tokens.d.ts

@@ -0,0 +1,15 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { UpstreamOAuthClient } from "./upstream_client.js";
+import type { IntrospectCache } from "./introspect_cache.js";
+/**
+ * POST /token — RFC 6749 §4.1.3 + §6 (refresh). Public client (PKCE), so no
+ * client_secret. We forward to the Upload-Post backend which owns the
+ * codes/tokens; this server just translates the wire format.
+ */
+export declare function handleToken(req: IncomingMessage, res: ServerResponse, upstream: UpstreamOAuthClient): Promise<void>;
+/**
+ * POST /revoke — RFC 7009. We also drop the cache so any cached entry for
+ * this token is killed immediately even if other instances re-introspect.
+ */
+export declare function handleRevoke(req: IncomingMessage, res: ServerResponse, upstream: UpstreamOAuthClient, cache: IntrospectCache): Promise<void>;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/oauth/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/oauth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/oauth/tokens.js

@@ -0,0 +1,43 @@
+import { readFormBody, sendError, sendJson } from "./http_utils.js";
+/**
+ * POST /token — RFC 6749 §4.1.3 + §6 (refresh). Public client (PKCE), so no
+ * client_secret. We forward to the Upload-Post backend which owns the
+ * codes/tokens; this server just translates the wire format.
+ */
+export async function handleToken(req, res, upstream) {
+    let form;
+    try {
+        form = await readFormBody(req);
+    }
+    catch {
+        return sendError(res, 400, "invalid_request", "Body must be form-urlencoded");
+    }
+    if (!form.grant_type)
+        return sendError(res, 400, "invalid_request", "grant_type required");
+    const params = new URLSearchParams(form);
+    const response = await upstream.exchangeOrRefresh(params);
+    res.statusCode = response.status;
+    res.setHeader("content-type", "application/json");
+    res.setHeader("cache-control", "no-store");
+    res.end(response.body);
+}
+/**
+ * POST /revoke — RFC 7009. We also drop the cache so any cached entry for
+ * this token is killed immediately even if other instances re-introspect.
+ */
+export async function handleRevoke(req, res, upstream, cache) {
+    let form;
+    try {
+        form = await readFormBody(req);
+    }
+    catch {
+        return sendError(res, 400, "invalid_request", "Body must be form-urlencoded");
+    }
+    const token = (form.token ?? "").trim();
+    if (token) {
+        cache.invalidate(token);
+        await upstream.revoke(token);
+    }
+    sendJson(res, 200, { success: true });
+}
+//# sourceMappingURL=tokens.js.map

package/dist/oauth/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/oauth/tokens.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEpE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAoB,EACpB,GAAmB,EACnB,QAA6B;IAE7B,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAE3F,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1D,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACjC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAoB,EACpB,GAAmB,EACnB,QAA6B,EAC7B,KAAsB;IAEtB,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACxC,CAAC"}

package/dist/oauth/upstream_client.d.ts

@@ -0,0 +1,32 @@
+import type { OAuthConfig } from "./config.js";
+/**
+ * Thin wrapper around the Upload-Post backend's internal OAuth endpoints.
+ * The MCP server never touches a database — all OAuth state lives upstream.
+ * This keeps schema ownership in one place and means the MCP container
+ * doesn't need DB credentials.
+ */
+export declare class UpstreamOAuthClient {
+    private readonly cfg;
+    constructor(cfg: OAuthConfig);
+    /** Proxies form data through to /api/uploadposts/oauth/token. */
+    exchangeOrRefresh(form: URLSearchParams): Promise<{
+        status: number;
+        body: string;
+    }>;
+    /** Proxies token revocation. */
+    revoke(token: string): Promise<void>;
+    /**
+     * Resolves an opaque access token to {email, api_key, scope, client_id}.
+     * Authenticated upstream with the shared internal secret. Returns null on
+     * inactive / unknown / network failure.
+     */
+    introspect(accessToken: string): Promise<IntrospectResult | null>;
+}
+export interface IntrospectResult {
+    active: true;
+    email: string;
+    api_key: string;
+    scope: string;
+    client_id?: string;
+}
+//# sourceMappingURL=upstream_client.d.ts.map

package/dist/oauth/upstream_client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream_client.d.ts","sourceRoot":"","sources":["../../src/oauth/upstream_client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;GAKG;AACH,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,WAAW;IAE7C,iEAAiE;IAC3D,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IASzF,gCAAgC;IAC1B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ1C;;;;OAIG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAwBxE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,IAAI,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/oauth/upstream_client.js

@@ -0,0 +1,62 @@
+/**
+ * Thin wrapper around the Upload-Post backend's internal OAuth endpoints.
+ * The MCP server never touches a database — all OAuth state lives upstream.
+ * This keeps schema ownership in one place and means the MCP container
+ * doesn't need DB credentials.
+ */
+export class UpstreamOAuthClient {
+    cfg;
+    constructor(cfg) {
+        this.cfg = cfg;
+    }
+    /** Proxies form data through to /api/uploadposts/oauth/token. */
+    async exchangeOrRefresh(form) {
+        const r = await fetch(`${this.cfg.upstreamBaseUrl}/api/uploadposts/oauth/token`, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: form.toString(),
+        });
+        return { status: r.status, body: await r.text() };
+    }
+    /** Proxies token revocation. */
+    async revoke(token) {
+        await fetch(`${this.cfg.upstreamBaseUrl}/api/uploadposts/oauth/revoke`, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ token }).toString(),
+        }).catch(() => undefined);
+    }
+    /**
+     * Resolves an opaque access token to {email, api_key, scope, client_id}.
+     * Authenticated upstream with the shared internal secret. Returns null on
+     * inactive / unknown / network failure.
+     */
+    async introspect(accessToken) {
+        try {
+            const r = await fetch(`${this.cfg.upstreamBaseUrl}/api/uploadposts/oauth/introspect`, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    "x-internal-secret": this.cfg.internalSecret,
+                },
+                body: JSON.stringify({ token: accessToken }),
+            });
+            if (!r.ok)
+                return null;
+            const data = (await r.json());
+            if (!data.active || !data.api_key || !data.email)
+                return null;
+            return {
+                active: true,
+                email: data.email,
+                api_key: data.api_key,
+                scope: data.scope ?? "mcp.full",
+                client_id: data.client_id,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=upstream_client.js.map

package/dist/oauth/upstream_client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream_client.js","sourceRoot":"","sources":["../../src/oauth/upstream_client.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,GAAgB;QAAhB,QAAG,GAAH,GAAG,CAAa;IAAG,CAAC;IAEjD,iEAAiE;IACjE,KAAK,CAAC,iBAAiB,CAAC,IAAqB;QAC3C,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,8BAA8B,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,gCAAgC;IAChC,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,+BAA+B,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;SAChD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,mCAAmC,EAAE;gBACpF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc;iBAC7C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAqD,CAAC;YAClF,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAC9D,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/schemas.d.ts

@@ -0,0 +1,38 @@
+import { z } from "zod";
+export declare const VideoPlatform: z.ZodEnum<["tiktok", "instagram", "youtube", "linkedin", "facebook", "pinterest", "threads", "bluesky", "x", "google_business", "discord", "telegram"]>;
+export declare const PhotoPlatform: z.ZodEnum<["tiktok", "instagram", "linkedin", "facebook", "pinterest", "threads", "reddit", "bluesky", "x", "google_business", "discord", "telegram"]>;
+export declare const TextPlatform: z.ZodEnum<["x", "linkedin", "facebook", "threads", "reddit", "bluesky", "google_business", "discord", "telegram"]>;
+export declare const AnalyticsPlatform: z.ZodEnum<["tiktok", "instagram", "youtube", "linkedin", "facebook", "pinterest", "threads", "bluesky", "x", "reddit", "google_business"]>;
+/**
+ * Common scheduling/queue fields shared by every upload tool.
+ */
+export declare const schedulingFields: {
+    scheduledDate: z.ZodOptional<z.ZodString>;
+    timezone: z.ZodOptional<z.ZodString>;
+    addToQueue: z.ZodOptional<z.ZodBoolean>;
+    maxPostsPerSlot: z.ZodOptional<z.ZodNumber>;
+    asyncUpload: z.ZodOptional<z.ZodBoolean>;
+    autogenerate: z.ZodOptional<z.ZodBoolean>;
+    autogenerateTitle: z.ZodOptional<z.ZodBoolean>;
+    autogenerateDescription: z.ZodOptional<z.ZodBoolean>;
+    autogenerateLanguage: z.ZodOptional<z.ZodString>;
+};
+export declare const genericResultOutputSchema: {
+    result: z.ZodUnknown;
+};
+/** Standard MCP-style content envelope. */
+export type ToolResult = {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    structuredContent?: {
+        result: unknown;
+    };
+    isError?: boolean;
+};
+export declare function ok(payload: unknown): ToolResult;
+export declare function fail(err: unknown): ToolResult;
+/** Wrap any tool handler so SDK/HTTP errors bubble up as MCP isError results. */
+export declare function safe<TArgs>(handler: (args: TArgs) => Promise<unknown>): (args: TArgs) => Promise<ToolResult>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,aAAa,yJAaxB,CAAC;AAEH,eAAO,MAAM,aAAa,wJAaxB,CAAC;AAEH,eAAO,MAAM,YAAY,oHAUvB,CAAC;AAEH,eAAO,MAAM,iBAAiB,4IAY5B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;CAgC5B,CAAC;AAEF,eAAO,MAAM,yBAAyB;;CAErC,CAAC;AAEF,2CAA2C;AAC3C,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,wBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAa/C;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAO7C;AAED,iFAAiF;AACjF,wBAAgB,IAAI,CAAC,KAAK,EACxB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,GACzC,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,UAAU,CAAC,CAStC"}

package/dist/schemas.js

@@ -0,0 +1,121 @@
+import { z } from "zod";
+export const VideoPlatform = z.enum([
+    "tiktok",
+    "instagram",
+    "youtube",
+    "linkedin",
+    "facebook",
+    "pinterest",
+    "threads",
+    "bluesky",
+    "x",
+    "google_business",
+    "discord",
+    "telegram",
+]);
+export const PhotoPlatform = z.enum([
+    "tiktok",
+    "instagram",
+    "linkedin",
+    "facebook",
+    "pinterest",
+    "threads",
+    "reddit",
+    "bluesky",
+    "x",
+    "google_business",
+    "discord",
+    "telegram",
+]);
+export const TextPlatform = z.enum([
+    "x",
+    "linkedin",
+    "facebook",
+    "threads",
+    "reddit",
+    "bluesky",
+    "google_business",
+    "discord",
+    "telegram",
+]);
+export const AnalyticsPlatform = z.enum([
+    "tiktok",
+    "instagram",
+    "youtube",
+    "linkedin",
+    "facebook",
+    "pinterest",
+    "threads",
+    "bluesky",
+    "x",
+    "reddit",
+    "google_business",
+]);
+/**
+ * Common scheduling/queue fields shared by every upload tool.
+ */
+export const schedulingFields = {
+    scheduledDate: z
+        .string()
+        .optional()
+        .describe("ISO 8601 date for scheduled publishing, e.g. '2026-12-25T10:00:00Z'. Omit for immediate post."),
+    timezone: z
+        .string()
+        .optional()
+        .describe("IANA timezone for scheduled date, e.g. 'Europe/Madrid'."),
+    addToQueue: z
+        .boolean()
+        .optional()
+        .describe("Insert into the user's posting queue instead of publishing now."),
+    maxPostsPerSlot: z.number().int().positive().optional(),
+    asyncUpload: z
+        .boolean()
+        .optional()
+        .describe("Return immediately with request_id (default true)."),
+    autogenerate: z
+        .boolean()
+        .optional()
+        .describe("If true, AI generates native per-platform title/description from the media and fills any field left empty."),
+    autogenerateTitle: z.boolean().optional().describe("Generate only the title with AI."),
+    autogenerateDescription: z.boolean().optional().describe("Generate only the description with AI."),
+    autogenerateLanguage: z
+        .string()
+        .optional()
+        .describe("Force the AI output language (ISO code); omit to auto-detect from the media."),
+};
+export const genericResultOutputSchema = {
+    result: z.unknown(),
+};
+export function ok(payload) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: typeof payload === "string"
+                    ? payload
+                    : JSON.stringify(payload, null, 2),
+            },
+        ],
+        structuredContent: { result: payload },
+    };
+}
+export function fail(err) {
+    const message = err instanceof Error ? err.message : typeof err === "string" ? err : JSON.stringify(err);
+    return {
+        isError: true,
+        content: [{ type: "text", text: message }],
+    };
+}
+/** Wrap any tool handler so SDK/HTTP errors bubble up as MCP isError results. */
+export function safe(handler) {
+    return async (args) => {
+        try {
+            const result = await handler(args);
+            return ok(result);
+        }
+        catch (err) {
+            return fail(err);
+        }
+    };
+}
+//# sourceMappingURL=schemas.js.map

package/dist/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC,QAAQ;IACR,WAAW;IACX,SAAS;IACT,UAAU;IACV,UAAU;IACV,WAAW;IACX,SAAS;IACT,SAAS;IACT,GAAG;IACH,iBAAiB;IACjB,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC,QAAQ;IACR,WAAW;IACX,UAAU;IACV,UAAU;IACV,WAAW;IACX,SAAS;IACT,QAAQ;IACR,SAAS;IACT,GAAG;IACH,iBAAiB;IACjB,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,GAAG;IACH,UAAU;IACV,UAAU;IACV,SAAS;IACT,QAAQ;IACR,SAAS;IACT,iBAAiB;IACjB,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,QAAQ;IACR,WAAW;IACX,SAAS;IACT,UAAU;IACV,UAAU;IACV,WAAW;IACX,SAAS;IACT,SAAS;IACT,GAAG;IACH,QAAQ;IACR,iBAAiB;CAClB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,+FAA+F,CAChG;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,yDAAyD,CAAC;IACtE,UAAU,EAAE,CAAC;SACV,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,iEAAiE,CAAC;IAC9E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC;SACX,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,oDAAoD,CAAC;IACjE,YAAY,EAAE,CAAC;SACZ,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,4GAA4G,CAC7G;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IACtF,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IAClG,oBAAoB,EAAE,CAAC;SACpB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,8EAA8E,CAAC;CAC5F,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC;AASF,MAAM,UAAU,EAAE,CAAC,OAAgB;IACjC,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EACF,OAAO,OAAO,KAAK,QAAQ;oBACzB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;aACvC;SACF;QACD,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAY;IAC/B,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3F,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,IAAI,CAClB,OAA0C;IAE1C,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,4 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { UploadPostMcpClient } from "./client.js";
+export declare function buildServer(client: UploadPostMcpClient): McpServer;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAmB,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAcnE,wBAAgB,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,SAAS,CA0BlE"}